A network proxy detection method, device, storage medium and computer equipment

Abstract

The present application discloses a network proxy detection method, device, storage medium and computer equipment; the present application is related to the field of machine learning of artificial intelligence, and the present application obtains network traffic in a target network; parses and matches the network traffic to obtain multiple target outbound traffic matching the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic; performs category query based on a mapping relationship between set business domain name information and set business category, and obtains the business category corresponding to the business domain name information; classifies the business categories corresponding to all target outbound traffic of the network proxy to be detected, so as to obtain the target business category of the network proxy to be detected, and category access information and category similarity information of the target business category; performs anomaly detection on the network proxy to be detected based on the category access information and category similarity information of the target business category, and obtains the detection result of the network proxy to be detected.

Description

Technical Field

[0001] The present application relates to the network field, and specifically to a network proxy detection method, device, storage medium and computer equipment. Background Art

[0002] With the development of communication technology, network proxy services can be introduced into the data transmission process, thereby effectively improving data transmission efficiency. However, in actual application, in addition to regular network proxy services, there are also illegal network proxy services. Illegal network proxy services may bring security and compliance problems to business service providers. Therefore, it is necessary to detect illegal network proxy services in the network. In the prior art, network proxy services can be determined by detecting key features such as the Socks protocol (a network transmission protocol) and the HTTP Connect method in network traffic, and then illegal network proxy services can be determined.

[0003] During the research and practice of the prior art, the inventors of the present application discovered that with the development of traffic encryption and traffic camouflage technology, it is no longer possible to determine network proxy services by detecting key features in network traffic, and it is also difficult to determine illegal network proxy services, resulting in great network security risks. Summary of the invention

[0004] The embodiments of the present application provide a network proxy detection method, apparatus, storage medium, and computer equipment, which can detect network proxies in a target network and identify illegal network proxy services, thereby effectively improving network security.

[0005] The present application provides a network proxy detection method, including:

[0006] Obtain network traffic in the target network;

[0007] Parsing and matching the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic;

[0008] Perform a category query based on the mapping relationship between the set service domain name information and the set service category to obtain the service category corresponding to the service domain name information;

[0009] Performing category integration on the service categories corresponding to all target outbound traffic of the network proxy to be detected, so as to obtain the target service category of the network proxy to be detected, and category access information and category similarity information of the target service category;

[0010] Based on the category access information and category similarity information of the target service category, anomaly detection is performed on the network agent to be detected to obtain a detection result of the network agent to be detected.

[0011] Accordingly, the present application provides a network proxy detection device, comprising:

[0012] An acquisition module is used to acquire network traffic in a target network;

[0013] A parsing module, used for parsing and matching the network traffic to obtain multiple target outbound traffic matching the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic;

[0014] A category determination module, used to perform category query based on the mapping relationship between the set service domain name information and the set service category, and obtain the service category corresponding to the service domain name information;

[0015] A target determination module, used for classifying the service categories corresponding to all target outbound traffic of the network proxy to be detected, so as to obtain the target service category of the network proxy to be detected, and the category access information and category similarity information of the target service category;

[0016] The result determination module is used to perform abnormal detection on the network agent to be detected based on the category access information and category similarity information of the target service category, and obtain the detection result of the network agent to be detected.

[0017] In some embodiments, the targeting module includes:

[0018] A category integration submodule, used to classify the service categories corresponding to all target outbound traffic of the network proxy to be detected, and obtain the target service category of the network proxy to be detected and the number of visits of the target service category;

[0019] A quantity processing submodule, used for performing quantity processing on the access quantity of the target service category to obtain category access information of the target service category;

[0020] The query submodule is used to query the category similarity information of the target business category.

[0021] In some embodiments, the access determination submodule is specifically used to:

[0022] The number of visits to the target business category is normalized by domain name visits to generate category visit information of the target business category.

[0023] In some embodiments, the result determination module is specifically used to:

[0024] Perform discrete calculation processing based on the category access information and category similarity information of the target service category to obtain the access behavior measurement of the network agent to be detected;

[0025] When the access behavior metric is greater than a preset threshold, a detection result of the network agent to be detected is determined.

[0026] In some embodiments, the network proxy detection device further includes:

[0027] The content acquisition module is used to obtain the business content corresponding to the set business domain name information;

[0028] The analysis module is used to perform category analysis on the business content to obtain the set business category corresponding to the set business domain name information to construct a target data set, wherein the target data set includes a mapping relationship between the set business domain name information and the set business category.

[0029] In some embodiments, the network proxy detection device further includes:

[0030] A benchmark configuration module, used to determine a service benchmark category from a plurality of set service categories, and configure category similarity benchmark information for the service benchmark category;

[0031] The allocation module is used to allocate category similarity information to the service category to be allocated according to the difference information between the service category to be allocated and the service benchmark category and the category similarity benchmark information.

[0032] In some embodiments, the result determination module is specifically used to:

[0033] Calling a category query interface of a target data set, wherein the target data set includes a mapping relationship between set service domain name information and set service categories;

[0034] The mapping relationship is acquired through the category query interface, and a category query is performed according to the mapping relationship to obtain the business category to which each business domain name information belongs.

[0035] In some embodiments, the parsing module includes a parsing submodule and an acquisition submodule, wherein:

[0036] The parsing submodule is used to parse the network traffic to obtain the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic;

[0037] The detection submodule is used to perform traffic detection based on the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic, and obtain multiple target outbound traffic matching the network proxy to be detected, as well as the business domain name information to be accessed by each target outbound traffic.

[0038] In some embodiments, the acquisition submodule includes a determination unit, a screening unit and a restoration unit, wherein:

[0039] a determining unit, configured to determine that the network traffic is candidate network traffic when a proxy address corresponding to the network traffic matches a target proxy address, and the target proxy address corresponds to the network proxy to be detected;

[0040] A search unit, configured to search for multiple target outbound flows from all candidate network flows according to the inbound and outbound flow types and protocol information of the candidate network flows;

[0041] The restoration unit is used to restore the data of the target outbound traffic to obtain the business domain name information to be accessed by the target outbound traffic.

[0042] In some embodiments, the screening unit is specifically used to:

[0043] When the traffic inbound and outbound type of the candidate network traffic is a target type, and the protocol information of the candidate network traffic is a target protocol, the candidate network traffic is determined to be a target outbound traffic, so as to find out a plurality of target outbound traffics from all candidate network traffics.

[0044] In some embodiments, the reduction unit is specifically used to:

[0045] When the protocol information of the target outbound traffic is the first target protocol, performing data restoration on the target outbound traffic and extracting request data of the target outbound traffic;

[0046] The service domain name information to be accessed by the target outgoing traffic is obtained from the request data.

[0047] In some embodiments, the reduction unit is specifically used to:

[0048] When the protocol information of the target outbound traffic is the second target protocol, performing data restoration on the target outbound traffic to obtain connection verification data of the target outbound traffic;

[0049] Based on the connection verification data, determine the service domain name information to be accessed by the target outgoing traffic.

[0050] Correspondingly, an embodiment of the present application further provides a storage medium, which stores a computer program, and the computer program is suitable for loading by a processor to execute any network proxy detection method provided in the embodiment of the present application.

[0051] Correspondingly, an embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any one of the network proxy detection methods provided in the embodiments of the present application is implemented.

[0052] The present application can obtain network traffic in a target network; parse and match the network traffic to obtain multiple target outbound traffic that matches the network agent to be detected, and business domain name information to be accessed by the target outbound traffic; perform category query based on a mapping relationship between set business domain name information and set business category to obtain the business category corresponding to the business domain name information; classify the business categories corresponding to all target outbound traffic of the network agent to be detected to obtain the target business category of the network agent to be detected, and category access information and category similarity information of the target business category; perform anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target business category to obtain the detection result of the network agent to be detected.

[0053] The present application can parse network traffic to determine the target outbound traffic that matches the network proxy to be detected, and then analyze it according to the business category corresponding to the target outbound traffic to obtain the target business category of the network proxy to be detected, as well as the category access information and category similarity information of the target business category, and then determine the detection result of the network proxy to be detected, thereby realizing the detection of network proxies in the target network and determining illegal network proxy services, thereby effectively improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 is a scenario diagram of a network proxy detection system provided by an embodiment of the present application;

[0056] Figure 2 It is a flowchart of a network proxy detection method provided by an embodiment of the present application;

[0057] Figure 3 It is a schematic diagram of the contents of the network proxy detection method provided in an embodiment of the present application;

[0058] Figure 4 It is a data schematic diagram of the network proxy detection method provided in an embodiment of the present application;

[0059] Figure 5It is an interactive schematic diagram of the network proxy detection method provided in an embodiment of the present application;

[0060] Figure 6 is another data schematic diagram of the network proxy detection method provided by an embodiment of the present application;

[0061] Figure 7 is another data schematic diagram of the network proxy detection method provided by an embodiment of the present application;

[0062] Figure 8 is another flow chart of the network proxy detection method provided by an embodiment of the present application;

[0063] Fig. 9 It is a schematic diagram of an implementation of a network proxy detection method provided in an embodiment of the present application;

[0064] Fig.10 It is a structural diagram of a network proxy detection device provided in an embodiment of the present application;

[0065] Fig.11 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described in this application are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0067] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0068] Machine Learning (ML) is a multi-disciplinary subject that involves probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning.

[0069] In the present application, the target business category of the network agent to be tested, as well as the category access information and category similarity information of the target business category are determined; the detection results of the network agent to be tested are determined, etc., which can be achieved through relevant technologies in the field of machine learning of artificial intelligence. For example, the detection solution results of the network agent to be tested can be output by detecting the network model, and so on.

[0070] The network proxy detection method of the present application can be integrated in a network proxy detection device, and the network proxy detection device can be integrated in one or more computer devices, and the computer device can include a terminal or a server, etc., wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to these. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and the present application does not limit this.

[0071] See also Figure 1 The network proxy detection system may include a network proxy detection device, which may be integrated in a detection server. Specifically, the detection server may obtain network traffic in a target network, parse and match the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic, and then perform a category query based on a mapping relationship between the set business domain name information and the set business category to obtain the business category corresponding to the business domain name information; classify the business categories corresponding to all target outbound traffic of the network proxy to be detected to obtain the target business category of the network proxy to be detected, and the category access information and category similarity information of the target business category; perform anomaly detection on the network proxy to be detected based on the category access information and category similarity information of the target business category to obtain the detection result of the network proxy to be detected.

[0072] It should be noted that Figure 1The scenario diagram of the network proxy detection system shown is only an example. The network proxy detection system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided by the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of network proxy detection devices and the emergence of new business scenarios, the technical solution provided by the embodiment of the present application is also applicable to similar technical problems.

[0073] In this embodiment, a network proxy detection method is described in detail. The network proxy detection method can be integrated on a server, such as Figure 2 As shown, Figure 2 : is a flow chart of a network proxy detection method provided by an embodiment of the present application. The network proxy detection method may include:

[0074] 101. Obtain network traffic in the target network.

[0075] Among them, the target network may include a network with a specific scope in the Internet. Depending on the size of the scope, the target network may include a local area network, a wide area network, etc. The target network may include a number of computer devices, and the computer devices may include business service providing devices and business service using devices. Between the business service providing devices (such as web servers) and the business service using devices (such as clients), the target network may also include network proxy devices. The network proxy devices can provide network proxy services. The network proxy devices can serve as a bridge between the business service using devices and the business service providing devices, and can store data, forward messages, etc.

[0076] The network traffic may include data frames transmitted between computer devices in the target network.

[0077] In the present application, there may be multiple ways to obtain network traffic in the target network, such as mirroring, network traffic replication, etc. The obtained network traffic may include a copy of the network traffic in the target network, a network traffic mirror file, etc.

[0078] 102. Analyze and match the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic.

[0079] There may be multiple computer devices in the target network. Network traffic may include data frames transmitted between computer devices. The purpose of this application is network proxy detection, so it is necessary to first filter out the target outbound traffic that matches the network proxy to be detected from all network traffic.

[0080] Among them, the network agent to be detected may include at least one network agent device in the target network, that is, the present application can detect part or all of the network agent devices in the target network and determine the detection results. The number of network agents to be detected can be flexibly set, for example, it can be flexibly determined based on actual needs or the data processing capabilities of computer equipment.

[0081] The target outbound traffic may include data frames sent by the network agent to be detected and based on specific protocol information, and the service domain name information may include domain name information of the service to be accessed indicated by the target outbound traffic.

[0082] Network traffic may include data frames obtained by encapsulating the data to be transmitted based on different layers of protocols. Therefore, the analysis of network traffic may include layer-by-layer analysis of data frames based on the protocols used in the encapsulation process. Different protocols will result in different analysis methods, which can be flexibly handled in actual applications.

[0083] For example, the network traffic in the target network W is obtained by traffic replication, and then the network traffic is parsed and matched to determine multiple target outbound traffic that matches the network agent 1 to be detected, as well as the business domain name information to be accessed by each target outbound traffic.

[0084] In some embodiments, the step of “parsing and matching network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic” may include:

[0085] Perform traffic analysis on the network traffic to obtain the proxy address, traffic inflow and outflow type, and protocol information corresponding to the network traffic; perform traffic detection based on the proxy address, traffic inflow and outflow type, and protocol information corresponding to the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, as well as the business domain name information to be accessed by each target outbound traffic.

[0086] Specifically, by parsing the network traffic, we can obtain the proxy address of the network traffic, the traffic inflow and outflow types, and the protocol information followed. Among them, the proxy address may include the address information of the network proxy device that sends the network traffic. The proxy address may include the logical address or physical address of the network proxy device. For example, the logical address may include an Internet Protocol address (IP address, Internet Protocol Address).

[0087] Among them, the traffic inbound and outbound types may include the outbound or inbound types of network traffic relative to the network proxy to be detected, and the traffic inbound and outbound types may include outbound types and inbound types, etc. The protocol information may include the protocols used by network traffic at different layers, such as the application layer protocol used by network traffic (such as request-response protocol), etc.

[0088] Specifically, traffic analysis and detection can be performed based on deep packet inspection technology to obtain the three-way handshake information in the network traffic, determine the proxy address of the network traffic and the type of traffic in and out, and determine the protocol information of the network traffic by analyzing the data format in the network traffic.

[0089] Based on the proxy address, traffic inbound and outbound type, and protocol information corresponding to the network traffic, the target outbound traffic that matches the network proxy to be detected is determined, and the target outbound traffic can be saved for further analysis and processing. The data can be saved directly or formatted before being saved. Formatting can be a step used to facilitate data storage.

[0090] Specifically, the target outbound traffic can be determined, for example, when at least one of the proxy address, traffic inbound and outbound type, and protocol information of the network traffic meets preset requirements, the network traffic can be determined to be the target outbound traffic.

[0091] For example, deep packet inspection technology can be used to detect the proxy address 1, traffic in / out type 1, and protocol information 1 of the network traffic, and then based on the deep packet inspection technology, multiple target outbound traffic determined based on the proxy address 1, traffic in / out type 1, and protocol information 1 of the network traffic, as well as the business domain name information corresponding to each target outbound traffic, can be captured.

[0092] In some embodiments, the step of "performing traffic detection based on the proxy address, traffic in / out type, and protocol information corresponding to the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and service domain name information to be accessed by each target outbound traffic" may include:

[0093] When the proxy address corresponding to the network traffic matches the target proxy address, the network traffic is determined to be candidate network traffic, and the target proxy address corresponds to the network proxy to be detected; based on the traffic inflow and outflow type and protocol information of the candidate network traffic, multiple target outbound traffic is found from all candidate network traffic; data of the target outbound traffic is restored to obtain the business domain name information to be accessed by the target outbound traffic.

[0094] Among them, the target proxy address may include the address corresponding to the network proxy to be detected, and the candidate network traffic may include traffic related to the network proxy to be detected. Specifically, when the proxy address corresponding to the network traffic matches the target proxy address, that is, the network traffic is traffic related to the network proxy to be detected, the network traffic can be determined as candidate network traffic.

[0095] Then, all candidate network traffic can be screened to find the target outbound traffic. The screening can be performed based on the traffic inbound and outbound types and protocol information of the candidate network traffic. For example, when the traffic inbound and outbound types and protocol information meet the preset correspondence, the candidate network traffic is determined to be the target outbound traffic.

[0096] Among them, the business domain name information may include the address information of the business to be accessed. The business domain name information can be obtained by restoring the target outbound traffic. The target outbound traffic uses different protocols, and the business domain name information can be determined by different restoration methods.

[0097] For example, the network proxy 1 to be detected corresponds to the target proxy address X. When the proxy address corresponding to the network traffic is the same as the target proxy address X, the network traffic can be determined as the candidate network traffic. The above operations are performed on all network traffic to determine all candidate network traffic in the target network. Then, the traffic inbound and outbound types and protocol information corresponding to each candidate network traffic can be used to obtain the target outbound traffic from all candidate network traffic, and each target outbound traffic can be restored to obtain the business domain name information corresponding to each target outbound traffic.

[0098] In some embodiments, the step of “finding multiple target outbound flows from all candidate network flows according to the inbound and outbound flow types and protocol information of the candidate network flows” may include:

[0099] When the traffic inbound and outbound type of the candidate network traffic is the target type, and the protocol information of the candidate network traffic is the target protocol, the candidate network traffic is determined to be the target outbound traffic, so as to find out multiple target outbound traffic from all the candidate network traffic.

[0100] The target type may include at least one type, and the target protocol may include at least one protocol.

[0101] For example, the target type corresponding to the target outgoing traffic is the outgoing type, the parsed traffic in / out types include the inbound type and the outbound type, and the target outgoing traffic corresponds to the target protocol 1. When the candidate network traffic corresponds to the outbound type and the target protocol 1, the candidate network traffic can be determined as the target outgoing traffic. The above screening process is performed on each candidate network type, and multiple target outgoing traffic can be determined from all candidate network traffic.

[0102] In some embodiments, the step of “restoring data of the target outbound traffic to obtain the service domain name information to be accessed by the target outbound traffic” may include:

[0103] When the protocol information of the target outbound traffic is the first target protocol, data restoration is performed on the target outbound traffic to extract the request data of the target outbound traffic; and the business domain name information to be accessed by the target outbound traffic is obtained from the request data.

[0104] When the protocol information of the network traffic is different, the method of obtaining the service domain name information may also be different. For example, the first target protocol may include Hypertext Transfer Protocol (HTTP), and the HTTP-based request message of the target outbound traffic may be parsed and restored. Figure 3 The HTTP request message may include a request line, a request header, and a request body. The request header in the request message usually includes the domain name information of the service to be accessed. For example, the host field in the request header usually describes the domain name of the target website to be accessed.

[0105] Therefore, the request data in the target outbound traffic can be extracted, and then the service domain name information to be accessed can be obtained from the request data.

[0106] For example, the target outbound traffic 1 is based on the HTTP protocol, so the target outbound traffic 1 can be restored to obtain the request message information (see Figure 4 ), and determine the request data from the request message information (see the first line POST / chapter17 / user.html HTTP / 1.1 in the figure), and then obtain the business domain name information 1 from the request data (for example, the business domain name information in the figure is / chapter17 / user.html).

[0107] In some embodiments, the step of “restoring data of the target outbound traffic to obtain the service domain name information to be accessed by the target outbound traffic” may include:

[0108] When the protocol information of the target outgoing traffic is the second target protocol, data restoration is performed on the target outgoing traffic to obtain connection verification data of the target outgoing traffic; based on the connection verification data, the business domain name information to be accessed by the target outgoing traffic is determined.

[0109] For example, the second target protocol may include Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS), and HTTPS may be transmitted using an encryption protocol, such as Transport Layer Security (TLS). Before transmitting data based on HTTPS and the encryption protocol, computer devices may perform a handshake to exchange relevant information to ensure reliable data transmission, such as, see Figure 5 , information will be transmitted between the client and the server. During this process, the data will carry the business domain name information of the server. For example, the data transmitted by the client in the ClientHlello stage will carry the business domain name information.

[0110] Therefore, the data transmitted in the handshake phase of the target outbound traffic can be parsed and restored to determine the business domain name information to be accessed by the target outbound traffic.

[0111] For example, the connection verification data in the target outbound traffic can be parsed and restored (such as Figure 6 In the first line, the connection verification data is the data under the Handshake Protocol of ClientHlello, that is, the content in the figure), and then find the business domain name information to be accessed by the target outbound traffic from the connection verification data (such as Figure 7 In the data of ClientHlello, the business domain name information tls13.cryto.mozilla.org can be queried in the server_name field).

[0112] 103. Perform category query based on the mapping relationship between the set service domain name information and the set service category to obtain the service category corresponding to the service domain name information.

[0113] The mapping relationship between the set service domain name information and the set service category may be predetermined, and the mapping relationship may include a plurality of groups of relationships between the set service domain name information and the set service category.

[0114] Specifically, the target setting domain name information that is the same as the business domain name information can be queried from the business domain name information of the mapping relationship, and then the target setting business category corresponding to the target setting domain name information can be found. The target setting business category is the business category corresponding to the business domain name information.

[0115] For example, from the mapping relationship set Y, find the target setting business domain name information 1 that is the same as the business domain name information 1, determine the target setting business category 1 corresponding to the target setting business domain name information 1, and determine that the target setting business category 1 is the business category corresponding to the business domain name information 1.

[0116] In some embodiments, the step of "performing a category query based on a mapping relationship between the set service domain name information and the set service category to obtain a service category corresponding to the service domain name information" may include:

[0117] The category query interface of the target data set is called, and the target data set includes a mapping relationship between set business domain name information and set business categories; the mapping relationship is obtained through the category query interface, and a category query is performed according to the mapping relationship to obtain the business category to which each business domain name information belongs.

[0118] The mapping relationship can be saved in the database. In order to efficiently and conveniently determine the business category corresponding to the business domain name information, the mapping relationship in the database can be quickly obtained through the business query interface, and then the business category corresponding to the business domain name information can be determined based on the mapping relationship.

[0119] This application can also directly query the business category to which the business domain name information belongs through the category query interface.

[0120] In some embodiments, the network proxy detection method further includes:

[0121] The business content corresponding to the set business domain name information is obtained; the business content is analyzed by category to obtain the set business category corresponding to the set business domain name information to construct a target data set, which includes a mapping relationship between the set business domain name information and the set business category.

[0122] Among them, business content may include content that can be accessed based on business domain name information. Business content can be presented in the form of text, image or video. To analyze business content, artificial intelligence technology can be used to build and train content analysis models, and the trained content analysis model can be used to determine the business category to which the business content belongs, that is, to determine the business category corresponding to the business domain name information; to analyze business content, it can also

[0123] By performing the above operation on each set service domain name information, a target data set including a mapping relationship between the set service domain name information and the set service category can be obtained.

[0124] For example, the set business domain name information 1 includes domain name address 1. Accessing the domain name address 1 can obtain the business content Q corresponding to the set domain name information 1. The set business category 1 corresponding to the business content Q is determined by the trained category determination model L to construct a target data set. The target data set may include mapping relationships between multiple sets of set business domain name information and set businesses.

[0125] 104. Classify the service categories corresponding to all target outbound traffic of the network proxy to be detected to obtain the target service category of the network proxy to be detected, and category access information and category similarity information of the target service category.

[0126] Among them, the target business category may include all business categories corresponding to the target outgoing traffic of the network agent to be detected, the category access information may include the proportion information of the target business category transmitted by the network agent to be detected and the information of all target categories transmitted by it, and the category similarity information may include the similarity degree between the target business category and other business categories.

[0127] Specifically, there may be a lot of target outbound traffic for the network agent to be detected, and each target outbound traffic corresponds to a business category. The business categories corresponding to different target outbound traffic may be the same. In order to better obtain the data content transmitted by the network agent to be detected, the business categories corresponding to all target outbound traffic can be integrated to obtain the target business category of the information transmitted by the network agent to be detected and its related information (such as category access information and category similarity information). The detection of the network agent to be detected is achieved through the target business category corresponding to the network agent to be detected and its related information.

[0128] In some embodiments, the step of “determining the target service category of the network proxy to be detected, and the category access information and category similarity information of the target service category according to the service category corresponding to all target outbound traffic of the network proxy to be detected” may include:

[0129] The business categories corresponding to all target outgoing traffic of the network proxy to be detected are integrated into categories to obtain the target business category of the network proxy to be detected and the number of visits to the target business category; the number of visits to the target business category is processed quantitatively to obtain the category access information of the target business category; and the category similarity information of the target business category is queried.

[0130] For example, the network proxy to be detected includes multiple target outbound traffic, each target outbound traffic corresponds to a business category, and different target outbound traffic can correspond to the same business category. Statistics show that all target outbound traffic corresponds to 10 business categories. These 10 business categories are target business categories. The number of target outbound traffic corresponding to each target business category is the number of visits to the target business category.

[0131] Based on the access data corresponding to all target business categories, the category access information of each target business category can be determined. In the network agent to be detected, the number of accesses to the target business category may be at a large level, and the number of accesses to different target business categories may also vary greatly. In order to facilitate subsequent calculations, quantitative calculation processing can be performed here based on the number of accesses to all target business categories to obtain the category access information of each target business category. Specifically, the calculation processing can be performed through standardization, normalization, and the like.

[0132] Finally, the category similarity information of the target business category may be queried, for example, from a database containing set category similarity information of multiple business categories.

[0133] In some embodiments, the step of “performing quantity processing on the access quantity of the target service category to obtain category access information of the target service category” may include:

[0134] The number of visits to the target business category is normalized by domain name visits to generate category visit information of the target business category.

[0135] Specifically, normalization may include linear function normalization, zero mean normalization, etc., which may be flexibly selected and processed in actual application scenarios and are not limited here.

[0136] In some embodiments, the network proxy detection method further includes:

[0137] Determine a business benchmark category from multiple set business categories, and configure category similarity benchmark information for the business benchmark category; allocate category similarity information to the business category to be allocated based on difference information between the business category to be allocated and the business benchmark category, as well as the category similarity benchmark information.

[0138] The business benchmark category may include a business category as a reference object, the category similarity benchmark information may include category similarity information as reference information, and the business benchmark category corresponds to the category similarity benchmark information.

[0139] There are many ways to determine the business benchmark category, such as determining it by random drawing, or sorting multiple set business categories and determining the business benchmark category based on the sorting results, etc. The category similarity benchmark information can represent the minimum / maximum information, median information, average information, etc. among all category similarity information. The category similarity benchmark information can be in the form of data, characters, etc., and can be flexibly set in actual applications. For example, category similarity benchmark information 10 can be configured for the business benchmark category.

[0140] Among them, the difference information may include quantifiable differences between the business category to be assigned and the business benchmark category. The difference information can be determined in a variety of ways. For example, it can be manually determined by relevant personnel based on experience. For example, it can also be based on relevant technologies in the field of natural language processing of artificial intelligence. Through a natural language processing model, the difference information between the business category to be assigned and the business benchmark category can be quantified, etc.

[0141] After determining the business benchmark category and its category similarity benchmark information, category similarity information can be allocated to the business category to be allocated based on the difference information between the business category to be allocated and the business benchmark category and with reference to the business similarity benchmark information.

[0142] When allocating category similarity information, there can be multiple allocation principles. For example, the smaller the difference information between the business category to be allocated and the business benchmark category, the smaller the difference between the category similarity information of the business category to be allocated and the business similarity benchmark information can be. The specific allocation principle can be flexibly determined based on the actual situation of the application scenario, and will not be elaborated here.

[0143] For example, a business benchmark category (such as the financial category) can be determined from multiple set business categories, and category similarity benchmark information m can be configured for the financial category. According to the difference value between the financial category and the business category to be assigned (such as the entertainment category), the category similarity benchmark information m of the financial category can be used to assign category similarity information c to the entertainment category.

[0144] 105. Based on the category access information and category similarity information of the target business category, perform anomaly detection on the network agent to be detected to obtain a detection result of the network agent to be detected.

[0145] The detection result may include a result of determining the service category to which the information that may be transmitted by the network to be detected belongs after analyzing the target service category contained in the information transmitted by the network to be detected.

[0146] Specifically, the access metric value corresponding to the interval where the category access information is located and the similarity metric value corresponding to the interval where the category similarity information is located can be determined respectively, and then anomaly detection is performed using the access metric value and the similarity metric value to obtain the detection result of the network agent to be detected.

[0147] For example, the network proxy to be detected may include multiple target business categories. The calculation weights of the category access information and category similarity information of each target business category are obtained, and then each target business category is calculated according to the calculation weights, and the calculation results of each target business category are summed up. The summed result is the detection result of the network proxy to be detected.

[0148] In some embodiments, the step of “performing anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target service category to obtain a detection result of the network agent to be detected” may include:

[0149] Discrete calculation processing is performed based on the category access information and category similarity information of the target business category to obtain the access behavior measurement of the network agent to be detected; when the access behavior measurement is greater than a preset threshold, the detection result of the network agent to be detected is determined.

[0150] In this embodiment, the access behavior metric may be in a numerical form, and the detection result may be in a more direct form such as text or characters. The access behavior metric may be implemented by calculating a standard deviation or the like.

[0151] Specifically, when the access behavior metric is greater than a preset threshold, the detection result of the network proxy to be detected is determined to be an unreliable network proxy (i.e., an unsafe and illegal network proxy); when the access behavior metric is less than the preset threshold, the detection result of the network proxy to be detected is determined to be a reliable network proxy.

[0152] The present application can parse network traffic to determine the target outbound traffic that matches the network proxy to be detected, and then analyze it according to the business category corresponding to the target outbound traffic to obtain the target business category of the network proxy to be detected, as well as the category access information and category similarity information of the target business category, and then determine the detection result of the network proxy to be detected, thereby realizing the detection of network proxies in the target network and determining illegal network proxy services, thereby effectively improving network security.

[0153] The method described in the above embodiment is further described in detail below with examples.

[0154] This application will take the network proxy detection system integrated in the computer device as an example to introduce the network proxy detection method. Figure 8 As shown, Figure 8 : is a flow chart of a network proxy detection method provided by an embodiment of the present application. The network proxy detection method may include:

[0155] 201. The computer device obtains network traffic in the target network.

[0156] 202. The computer device parses the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic.

[0157] For example, the IP address of the network proxy to be detected may be IP11. Based on deep detection technology, the computer device captures the active outbound traffic of the network proxy IP11 to be detected from the target network. Specifically, it can be determined based on the information of the three-way handshake in the network traffic, and the active outbound traffic is saved in the form of a data file. Then, from the active outbound traffic, the target outbound traffic based on HTTP and HTTPS and passed the inspection and processing (the purpose of the inspection and processing is to screen out unexpected situations such as parsing errors) is determined, and based on HTTP and HTTPS, the corresponding network traffic restoration method is used to obtain the business domain name information to be accessed by the target outbound traffic.

[0158] 203. The computer device determines the service category corresponding to the service domain name information based on the mapping relationship between the set service domain name information and the set service category.

[0159] For example, the mapping relationship between the set business domain name information and the set business category can be stored in the data set in advance, and the business category corresponding to the business domain name information can be determined, and the interface of the data set can be called to directly query.

[0160] 204. The computer device determines the target business category of the network proxy to be detected and the number of accesses of the target business category according to the business categories corresponding to all target outbound traffic of the network proxy to be detected.

[0161] For example, all target outbound traffic of the network proxy to be detected is integrated and counted to obtain the target business categories of the network proxy to be detected (category 1, category 2, category 3 and category 4), as well as the number of visits to each target business category (category 1 is 500, category 2 is 3000, category 3 is 100 and category 4 is 2500).

[0162] 205. The computer device normalizes the access quantity of the target service category to generate category access information of the target service category.

[0163] For example, the access data of the target service category is normalized by a linear function normalization method to obtain category access information of the target service analogy (category 1 is 0.83, category 2 is 1, category 3 is 0, and category 4 is 0.83).

[0164] 206. The computer device queries the category similarity information of the target business category.

[0165] For example, the category similarity information of the business category may be pre-stored in a data set, and the similarity information query interface of the data set may be called to directly query the category similarity information of the target business category.

[0166] 207. The computer device calculates the access behavior metric of the network agent to be detected based on the category access information and category similarity information of the target business category.

[0167] For example, the category access information and category similarity information of the target business category may be weighted and then the standard deviation of the weighted calculation results of all target business categories may be calculated to obtain the access behavior measurement of the network agent to be detected.

[0168] 208. When the access behavior metric matches a preset threshold, the computer device determines a detection result of the network proxy to be detected.

[0169] For example, the preset threshold may be threshold 1. When the access behavior metric is greater than threshold 1, the network proxy to be detected may be determined to be an unreliable network proxy. When the access behavior metric is less than threshold 1, the network proxy to be detected may be determined to be a reliable network proxy.

[0170] See also Fig. 9 The present application can first determine the IP to be analyzed (i.e., the logical address of the network proxy to be detected), and then analyze the active outgoing session traffic of the IP to be analyzed through the deep packet inspection technical step, and analyze the traffic type of the active outgoing session traffic. When the active outgoing session traffic is based on the http protocol, the business domain name information to be accessed (i.e., the business domain name information of the target outgoing traffic) can be determined from the host field in the active outgoing session traffic. When the active outgoing session traffic is based on the https protocol, the business domain name information to be accessed (i.e., the business domain name information of the target outgoing traffic) can be determined from the ServerName field in the active outgoing session traffic.

[0171] Then the domain name data is processed and the domain name visits are normalized (i.e., the number of visits to the target business category is normalized to generate category visit information of the target business category). At the same time, the category similarity information of the target business category is queried, and based on the category access information and category similarity information obtained after normalization, the discrete value of the access behavior is calculated. When the discrete value exceeds the threshold, the network agent to be detected is determined to be an unreliable commercial agent. When the discrete value does not exceed the threshold, the network agent to be detected is determined to be a reliable commercial agent or a non-commercial agent.

[0172] Prior to this, the present application may also pre-define domain name classifications (business categories) and proximity metrics of domain name classifications (category similarity information), and store them in a data set so that the present solution can determine the business category corresponding to the business domain name information of the target outgoing traffic, and query the category similarity information corresponding to the target domain name category.

[0173] The present application can parse network traffic to determine the target outbound traffic that matches the network proxy to be detected, and then analyze it according to the business category corresponding to the target outbound traffic to obtain the target business category of the network proxy to be detected, as well as the category access information and category similarity information of the target business category, and then determine the detection result of the network proxy to be detected, thereby realizing the detection of network proxies in the target network and determining illegal network proxy services, thereby effectively improving network security.

[0174] In order to better implement the network proxy detection method provided in the embodiment of the present application, the embodiment of the present application also provides a device based on the above network proxy detection method. The meanings of the terms are the same as those in the above network proxy detection method, and the specific implementation details can refer to the description in the method embodiment.

[0175] like Fig.10 As shown, Fig.10 A schematic diagram of the structure of a network proxy detection device provided in an embodiment of the present application, wherein the network proxy detection device may include an acquisition module 301, a parsing module 302, a category determination module 303, a target determination module 304, and a result determination module 305, wherein:

[0176] The acquisition module 301 is used to acquire the network traffic in the target network;

[0177] The parsing module 302 is used to parse and match the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and the service domain name information to be accessed by the target outbound traffic;

[0178] The category determination module 303 is used to perform category query based on the mapping relationship between the set service domain name information and the set service category, and obtain the service category corresponding to the service domain name information;

[0179] The target determination module 304 is used to classify the service categories corresponding to all target outbound traffic of the network agent to be detected, so as to obtain the target service category of the network agent to be detected, and the category access information and category similarity information of the target service category;

[0180] The result determination module 305 is used to perform anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target service category, and obtain the detection result of the network agent to be detected.

[0181] In some embodiments, the targeting module includes:

[0182] The category integration submodule is used to classify the business categories corresponding to all target outbound traffic of the network proxy to be detected, and obtain the target business category of the network proxy to be detected and the number of visits to the target business category;

[0183] The quantity processing submodule is used to perform quantity processing on the access quantity of the target business category to obtain category access information of the target business category;

[0184] The query submodule is used to query the category similarity information of the target business category.

[0185] In some embodiments, the access determination submodule is specifically used to:

[0186] The number of visits to the target business category is normalized by domain name visits to generate category visit information of the target business category.

[0187] In some embodiments, the result determination module is specifically used to:

[0188] Based on the category access information and category similarity information of the target business category, discrete calculation processing is performed to obtain the access behavior measurement of the network agent to be detected;

[0189] When the access behavior metric is greater than a preset threshold, a detection result of the network proxy to be detected is determined.

[0190] In some embodiments, the network proxy detection device further includes:

[0191] The content acquisition module is used to obtain the business content corresponding to the set business domain name information;

[0192] The analysis module is used to perform category analysis on the business content to obtain the set business category corresponding to the set business domain name information to construct a target data set, which includes a mapping relationship between the set business domain name information and the set business category.

[0193] In some embodiments, the network proxy detection device further includes:

[0194] A benchmark configuration module, used to determine a business benchmark category from a plurality of set business categories, and configure category similarity benchmark information for the business benchmark category;

[0195] The allocation module is used to allocate category similarity information to the business category to be allocated according to the difference information between the business category to be allocated and the business benchmark category, as well as the category similarity benchmark information.

[0196] In some embodiments, the result determination module is specifically used to:

[0197] Calling the category query interface of the target data set, where the target data set includes a mapping relationship between set business domain name information and set business categories;

[0198] The mapping relationship is obtained through the category query interface, and a category query is performed according to the mapping relationship to obtain the business category to which each business domain name information belongs.

[0199] In some embodiments, the parsing module includes a parsing submodule and an acquisition submodule, wherein:

[0200] The parsing submodule is used to parse the network traffic and obtain the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic;

[0201] The detection submodule is used to perform traffic detection based on the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic, and obtain multiple target outbound traffic that matches the network proxy to be detected, as well as the business domain name information to be accessed by each target outbound traffic.

[0202] In some embodiments, the acquisition submodule includes a determination unit, a screening unit, and a restoration unit, wherein:

[0203] a determination unit, configured to determine that the network traffic is candidate network traffic when the proxy address corresponding to the network traffic matches the target proxy address, and the target proxy address corresponds to the network proxy to be detected;

[0204] A search unit, used for searching for multiple target outgoing traffic from all candidate network traffic according to the traffic inbound and outbound types and protocol information of the candidate network traffic;

[0205] The restoration unit is used to restore the data of the target outbound traffic to obtain the business domain name information to be accessed by the target outbound traffic.

[0206] In some embodiments, the screening unit is specifically used to:

[0207] When the traffic inbound and outbound type of the candidate network traffic is the target type, and the protocol information of the candidate network traffic is the target protocol, the candidate network traffic is determined to be the target outbound traffic, so as to find out multiple target outbound traffic from all the candidate network traffic.

[0208] In some embodiments, the reduction unit is specifically used to:

[0209] When the protocol information of the target outbound traffic is the first target protocol, data restoration is performed on the target outbound traffic to extract request data of the target outbound traffic;

[0210] From the request data, obtain the business domain name information to be accessed by the target outbound traffic.

[0211] In some embodiments, the reduction unit is specifically used to:

[0212] When the protocol information of the target outbound traffic is the second target protocol, data restoration is performed on the target outbound traffic to obtain connection verification data of the target outbound traffic;

[0213] Based on the connection verification data, determine the business domain name information to be accessed by the target outbound traffic.

[0214] In the present application, the acquisition module 301 acquires the network traffic in the target network, the parsing module 302 parses and matches the network traffic to obtain multiple target outbound traffic matching the network agent to be detected, and the business domain name information to be accessed by the target outbound traffic, and then the category determination module 303 performs a category query based on the mapping relationship between the set business domain name information and the set business category to obtain the business category corresponding to the business domain name information, the target determination module 304 classifies the business categories corresponding to all target outbound traffic of the network agent to be detected to obtain the target business category of the network agent to be detected, and the category access information and category similarity information of the target business category, and finally the result determination module 305 performs anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target business category to obtain the detection result of the network agent to be detected.

[0215] The present application can parse network traffic to determine the target outbound traffic that matches the network proxy to be detected, and then analyze it according to the business category corresponding to the target outbound traffic to obtain the target business category of the network proxy to be detected, as well as the category access information and category similarity information of the target business category, and then determine the detection result of the network proxy to be detected, thereby realizing the detection of network proxies in the target network and determining illegal network proxy services, thereby effectively improving network security.

[0216] In addition, the embodiment of the present application also provides a computer device, which can be a terminal or a server. Fig.11 As shown, it shows a schematic diagram of the structure of the computer device involved in the embodiment of the present application, specifically:

[0217] The computer device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will appreciate that Fig.11 The computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. Among them:

[0218] The processor 401 is the control center of the computer device. It uses various interfaces and lines to connect various parts of the entire computer device. By running or executing software programs and / or modules stored in the memory 402 and calling data stored in the memory 402, it executes various functions of the computer device and processes data, thereby performing overall detection of the computer device. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user pages and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 401.

[0219] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0220] The computer device also includes a power supply 403 for supplying power to various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, so as to manage charging, discharging, and power consumption through the power management system. The power supply 403 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0221] The computer device may further include an input unit 404, which may be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control.

[0222] Although not shown, the computer device may further include a display unit, etc., which will not be described in detail herein. Specifically in this embodiment, the processor 401 in the computer device will load the executable files corresponding to the processes of one or more application programs into the memory 402 according to the following instructions, and the processor 401 will run the application programs stored in the memory 402, thereby realizing various functions, as follows:

[0223] Acquire the network traffic in the target network; parse and match the network traffic to obtain multiple target outbound traffic that matches the network agent to be detected, and the business domain name information to be accessed by the target outbound traffic; perform category query based on the mapping relationship between the set business domain name information and the set business category to obtain the business category corresponding to the business domain name information; classify the business categories corresponding to all target outbound traffic of the network agent to be detected to obtain the target business category of the network agent to be detected, and the category access information and category similarity information of the target business category; perform anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target business category to obtain the detection result of the network agent to be detected.

[0224] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0225] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in various optional implementations in the above-mentioned embodiments.

[0226] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by a computer program, or by controlling related hardware through a computer program. The computer program may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0227] To this end, an embodiment of the present application further provides a storage medium in which a computer program is stored, and the computer program can be loaded by a processor to execute the steps in any network proxy detection method provided in the embodiment of the present application. For example, the computer program can execute the following steps:

[0228] Acquire the network traffic in the target network; parse and match the network traffic to obtain multiple target outbound traffic that matches the network agent to be detected, and the business domain name information to be accessed by the target outbound traffic; perform category query based on the mapping relationship between the set business domain name information and the set business category to obtain the business category corresponding to the business domain name information; classify the business categories corresponding to all target outbound traffic of the network agent to be detected to obtain the target business category of the network agent to be detected, and the category access information and category similarity information of the target business category; perform anomaly detection on the network agent to be detected based on the category access information and category similarity information of the target business category to obtain the detection result of the network agent to be detected.

[0229] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0230] Since the computer program stored in the storage medium can execute the steps in any one of the network proxy detection methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any one of the network proxy detection methods provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0231] The above is a detailed introduction to a network proxy detection method, device, storage medium and computer equipment provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A network proxy detection method, characterized in that: include: Obtain network traffic in the target network; Parsing and matching the network traffic to obtain multiple target outbound traffic that matches the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic; Perform a category query based on the mapping relationship between the set business domain name information and the set business category to obtain the business category corresponding to the business domain name information; Performing category integration on the service categories corresponding to all target outbound traffic of the network proxy to be detected, so as to obtain the target service category of the network proxy to be detected, and category access information and category similarity information of the target service category, wherein the category access information is information related to the number of accesses to the target service category, and the category similarity information reflects the degree of similarity between the target service category and other service categories; Based on the category access information and category similarity information of the target service category, anomaly detection is performed on the network agent to be detected to obtain a detection result of the network agent to be detected.

2. The method according to claim 1, characterized in that The class integration of the service classes corresponding to all target outbound traffic of the network proxy to be detected to obtain the target service class of the network proxy to be detected, and the class access information and class similarity information of the target service class includes: Classify the service categories corresponding to all target outbound traffic of the network proxy to be detected to obtain the target service category of the network proxy to be detected and the number of accesses to the target service category; Performing quantity processing on the access quantity of the target service category to obtain category access information of the target service category; Query the category similarity information of the target business category.

3. The method according to claim 2, characterized in that The step of performing quantity processing on the access quantity of the target service category to obtain category access information of the target service category includes: The number of visits to the target business category is normalized by domain name visits to generate category visit information of the target business category.

4. The method according to claim 1, characterized in that: The performing of abnormality detection on the network agent to be detected based on the category access information and category similarity information of the target service category to obtain the detection result of the network agent to be detected includes: Perform discrete calculation processing based on the category access information and category similarity information of the target service category to obtain the access behavior measurement of the network agent to be detected; When the access behavior metric is greater than a preset threshold, a detection result of the network agent to be detected is determined.

5. The method according to claim 1, characterized in that The method further comprises: Get the business content corresponding to the set business domain name information; The service content is subjected to category analysis to obtain the set service category corresponding to the set service domain name information, so as to construct a target data set, wherein the target data set includes a mapping relationship between the set service domain name information and the set service category.

6. The method according to claim 1, characterized in that The method further comprises: Determine a business benchmark category from a plurality of set business categories, and configure category similarity benchmark information for the business benchmark category; According to the difference information between the service category to be allocated and the service benchmark category, and the category similarity benchmark information, category similarity information is allocated to the service category to be allocated.

7. The method according to claim 1, characterized in that The performing category query based on the mapping relationship between the set service domain name information and the set service category to obtain the service category corresponding to the service domain name information includes: Calling a category query interface of a target data set, wherein the target data set includes a mapping relationship between set service domain name information and set service categories; The mapping relationship is acquired through the category query interface, and a category query is performed according to the mapping relationship to obtain the business category to which each business domain name information belongs.

8. The method according to claim 1, characterized in that The parsing and matching processing of the network traffic to obtain a plurality of target outbound traffic matching the network proxy to be detected, and the service domain name information to be accessed by the target outbound traffic, includes: Performing traffic analysis on the network traffic to obtain the proxy address, traffic inflow and outflow type, and protocol information corresponding to the network traffic; Traffic detection is performed based on the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic, and multiple target outbound traffic matching the network proxy to be detected and the business domain name information to be accessed by each target outbound traffic are obtained.

9. The method according to claim 8, characterized in that The flow detection is performed based on the proxy address, flow in / out type and protocol information corresponding to the network flow, and a plurality of target outbound flows matching the network proxy to be detected and the service domain name information to be accessed by each target outbound flow are obtained, including: When the proxy address corresponding to the network traffic matches the target proxy address, determining that the network traffic is candidate network traffic, and the target proxy address corresponds to the network proxy to be detected; According to the traffic inflow and outflow type and protocol information of the candidate network traffic, multiple target outbound traffic is found from all the candidate network traffic; Data restoration is performed on the target outbound traffic to obtain business domain name information to be accessed by the target outbound traffic.

10. The method according to claim 9, characterized in that The step of searching for multiple target outbound flows from all candidate network flows according to the inbound and outbound flow types and protocol information of the candidate network flows includes: When the traffic inbound and outbound type of the candidate network traffic is a target type, and the protocol information of the candidate network traffic is a target protocol, the candidate network traffic is determined to be a target outbound traffic, so as to find out a plurality of target outbound traffics from all candidate network traffics.

11. The method according to claim 9, characterized in that The performing data restoration on the target outbound traffic to obtain the service domain name information to be accessed by the target outbound traffic includes: When the protocol information of the target outbound traffic is the first target protocol, performing data restoration on the target outbound traffic and extracting request data of the target outbound traffic; The service domain name information to be accessed by the target outgoing traffic is obtained from the request data.

12. The method according to claim 9, characterized in that The performing data restoration on the target outbound traffic to obtain the service domain name information to be accessed by the target outbound traffic includes: When the protocol information of the target outbound traffic is the second target protocol, performing data restoration on the target outbound traffic to obtain connection verification data of the target outbound traffic; Based on the connection verification data, determine the service domain name information to be accessed by the target outgoing traffic.

13. A network proxy detection device, characterized in that: include: An acquisition module is used to acquire network traffic in a target network; A parsing module, used for parsing and matching the network traffic to obtain multiple target outbound traffic matching the network proxy to be detected, and business domain name information to be accessed by the target outbound traffic; A category determination module, used to perform category query based on the mapping relationship between the set service domain name information and the set service category, and obtain the service category corresponding to the service domain name information; a target determination module, used for classifying the service categories corresponding to all target outbound traffic of the network proxy to be detected, so as to obtain the target service category of the network proxy to be detected, and the category access information and category similarity information of the target service category, wherein the category access information is information related to the number of accesses to the target service category, and the category similarity information reflects the degree of similarity between the target service category and other service categories; The result determination module is used to perform abnormal detection on the network agent to be detected based on the category access information and category similarity information of the target service category, and obtain the detection result of the network agent to be detected.

14. The device according to claim 13, characterized in that The targeting module includes: A category integration submodule, used to classify the service categories corresponding to all target outbound traffic of the network proxy to be detected, and obtain the target service category of the network proxy to be detected and the number of visits of the target service category; A quantity processing submodule, used for performing quantity processing on the access quantity of the target service category to obtain category access information of the target service category; The query submodule is used to query the category similarity information of the target business category.

15. The device according to claim 14, characterized in that The quantity processing submodule is specifically used to perform domain name access quantity normalization processing on the access quantity of the target business category to generate category access information of the target business category.

16. The device according to claim 13, characterized in that The result determination module is specifically used for: Perform discrete calculation processing based on the category access information and category similarity information of the target service category to obtain the access behavior measurement of the network agent to be detected; When the access behavior metric is greater than a preset threshold, a detection result of the network agent to be detected is determined.

17. The device according to claim 13, characterized in that The device also includes: The content acquisition module is used to obtain the business content corresponding to the set business domain name information; The analysis module is used to perform category analysis on the business content to obtain the set business category corresponding to the set business domain name information to construct a target data set, wherein the target data set includes a mapping relationship between the set business domain name information and the set business category.

18. The device according to claim 13, characterized in that The device also includes: A benchmark configuration module, used to determine a service benchmark category from a plurality of set service categories, and configure category similarity benchmark information for the service benchmark category; The allocation module is used to allocate category similarity information to the service category to be allocated according to the difference information between the service category to be allocated and the service benchmark category, and the category similarity benchmark information.

19. The device according to claim 13, characterized in that The result determination module is specifically used for: Calling a category query interface of a target data set, wherein the target data set includes a mapping relationship between set service domain name information and set service categories; The mapping relationship is acquired through the category query interface, and a category query is performed according to the mapping relationship to obtain the business category to which each business domain name information belongs.

20. The device according to claim 13, characterized in that The parsing module includes a parsing submodule and an acquisition submodule; The analysis submodule is used to perform flow analysis on the network flow to obtain the proxy address, flow in / out type and protocol information corresponding to the network flow; The acquisition submodule is used to perform traffic detection based on the proxy address, traffic inflow and outflow type and protocol information corresponding to the network traffic, and obtain multiple target outbound traffic matching the network proxy to be detected, as well as the business domain name information to be accessed by each target outbound traffic.

21. The device according to claim 20, characterized in that The acquisition submodule includes a determination unit, a screening unit and a restoration unit, wherein: a determining unit, configured to determine that the network traffic is candidate network traffic when a proxy address corresponding to the network traffic matches a target proxy address, and the target proxy address corresponds to the network proxy to be detected; A search unit, configured to search for multiple target outbound flows from all candidate network flows according to the inbound and outbound flow types and protocol information of the candidate network flows; The restoration unit is used to restore the data of the target outbound traffic to obtain the business domain name information to be accessed by the target outbound traffic.

22. The device according to claim 21, characterized in that The screening unit is specifically used for: When the traffic inbound and outbound type of the candidate network traffic is a target type, and the protocol information of the candidate network traffic is a target protocol, the candidate network traffic is determined to be a target outbound traffic, so as to find out a plurality of target outbound traffics from all candidate network traffics.

23. The device according to claim 21, characterized in that The reduction unit is specifically used for: When the protocol information of the target outbound traffic is the first target protocol, performing data restoration on the target outbound traffic and extracting request data of the target outbound traffic; The service domain name information to be accessed by the target outgoing traffic is obtained from the request data.

24. The device according to claim 21, characterized in that The reduction unit is specifically used for: When the protocol information of the target outbound traffic is the second target protocol, performing data restoration on the target outbound traffic to obtain connection verification data of the target outbound traffic; Based on the connection verification data, determine the service domain name information to be accessed by the target outgoing traffic.

25. A storage medium, characterized in that: The storage medium stores a plurality of computer programs, and the computer programs are suitable for being loaded by a processor to execute the steps in any one of the methods according to claims 1 to 12.

26. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 12 are implemented.

Images